Crypto-erasure of data stored in a key per io-enabled device via internal action
AssigneeInternational Business Machines Corporation
InventorGlen Alan Jaquette
Life of this patent
Estimating the term…
Abstract
Device-implemented methodology for enabling and/or performing crypto-erase via internal action and/or external action in a Key per IO-enabled system. In various approaches, crypto-erasure of the data stored in a Key per IO scheme is enabled by implementing an internal key, which is combined with an external key to generate a media encryption key, which is in turn used to encrypt/decrypt data. By restricting access to the internal key, destruction of the internal key and all media encryption key(s) created using the internal key, renders the data crypto-erased, and thus unrecoverable.
Claims20
A device-implemented method, comprising:
- receiving, at a device configured to perform data operations on a storage medium, one or more unique external keys, the one or more external keys being served to the device from one or more external sources for Key per IO operation;
- accessing an internal key stored within the device;
- generating a unique media encryption key for each of at least some of the one or more external keys using the internal key and the associated one of the one or more external keys, each media encryption key being associated with the external key used for generation thereof;
- and
- in response to receiving a request to perform a data operation for data associated with one of the one or more external keys, using the media encryption key associated with that external key to encrypt and/or decrypt the data.
A device-implemented method, comprising:
- receiving, at a device configured to perform data operations on a storage medium, a request to write first data to the storage medium in encrypted form using a first external key associated with the first data;
- accessing an internal key stored within the device;
- generating a first media encryption key using the internal key and the first external key;
- encrypting the first data using the first media encryption key;
- writing the encrypted first data to the storage medium in a first logical block address range of the storage medium;
- receiving, at the device, a second request to write second data to the storage medium in encrypted form using a second external key associated with the second data;
- accessing the internal key stored within the device;
- generating a second media encryption key using the internal key and the second external key;
- encrypting the second data using the second media encryption key;
- and
- writing the encrypted second data to the storage medium in the first logical block address range of the storage medium.
A device-implemented method for crypto-erase, the method comprising:
- receiving, at a device configured to perform data operations on a storage medium using Key per IO operation, a request to cause crypto-erasure of all data in at least one logical block address range of the storage medium,
- individual portions of the data in the at least one logical block address range each being associated with a unique external key, the individual portions of the data each being encrypted using a unique media encryption key created using an internal key and the unique external key associated with the portion of the data;
- and
- achieving the crypto-erase by destroying the internal key and all media encryption key(s) associated therewith in the device.
Dependencies are inferred from the claim text.